<html>
<head><meta charset="utf-8"><title>stacked borrows: barriers for non-frrozen shared refs? · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html">stacked borrows: barriers for non-frrozen shared refs?</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="148119061"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148119061" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148119061">(Nov 21 2018 at 15:55)</a>:</h4>
<p>Right now, my idea of barriers is that we make sure that in a <code>fn foo(x: &amp;mut i32)</code>, the item for this reference cannot get popped off the stack while the function is running. However, I cannot do that for <code>&amp;UnsafeCell</code>, because I am pushing the barrier on top of the stack, but an <code>&amp;UnsafeCell</code> can be fairly deep down the stack when it is passed to a function (like when there is also an <code>&amp;mut</code> pointing into the same <code>RefCell</code>/<code>Mutex</code>). But that means that an <code>&amp;UnsafeCell</code> could actually become invalid, and even deallocated, during the execution of a function -- in contradiction to the <code>dereferencable</code> attribute we set for LLVM. I see two options:</p>
<ul>
<li>No longer emit that attribute. Maybe change it to <code>dereferencable_on_entry</code> once <a href="https://lists.llvm.org/pipermail/llvm-dev/2018-July/124555.html" target="_blank" title="https://lists.llvm.org/pipermail/llvm-dev/2018-July/124555.html">LLVM supports that</a>. This would also fix <code>Arc::drop</code>, which is <a href="https://internals.rust-lang.org/t/is-it-possible-to-be-memory-safe-with-deallocated-self/8457/8" target="_blank" title="https://internals.rust-lang.org/t/is-it-possible-to-be-memory-safe-with-deallocated-self/8457/8">currently technically unsound</a> (the <code>ArcInner</code> could get deallocated while <code>AtomicUsize::fetch_sub</code> still holds a shared reference to it).</li>
<li>Push barriers into the middle of the stack. Then we can also have barriers for <code>&amp;UnsafeCell</code>, but we'd do a step away from the idea of the stack. However, we already are nit entirely a stack with this <code>frozen_since</code> business, and indeed this alternative could allow us to replace <code>frozen_since</code> by another kind of item on the stack.</li>
</ul>
<p>Cc <span class="user-mention" data-user-id="116009">@nikomatsakis</span> <span class="user-mention" data-user-id="137587">@Gankro</span></p>



<a name="148119079"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148119079" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148119079">(Nov 21 2018 at 15:55)</a>:</h4>
<p>by barriers do we mean C11 concurrency stuff?</p>



<a name="148119084"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148119084" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148119084">(Nov 21 2018 at 15:56)</a>:</h4>
<p>no, I just picked a bad name and cannot find a better one</p>



<a name="148119123"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148119123" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148119123">(Nov 21 2018 at 15:56)</a>:</h4>
<p>this has nothing to do with concurrency</p>



<a name="148119126"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148119126" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148119126">(Nov 21 2018 at 15:56)</a>:</h4>
<p>cool</p>



<a name="148119128"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148119128" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148119128">(Nov 21 2018 at 15:56)</a>:</h4>
<p>I described it in my <a href="https://www.ralfj.de/blog/2018/08/07/stacked-borrows.html#42-barriers" target="_blank" title="https://www.ralfj.de/blog/2018/08/07/stacked-borrows.html#42-barriers">first stacked borrows post</a></p>



<a name="148119153"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148119153" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148119153">(Nov 21 2018 at 15:56)</a>:</h4>
<p>if you can come up with a better name, please let me know :)</p>



<a name="148120162"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148120162" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148120162">(Nov 21 2018 at 16:12)</a>:</h4>
<p>Oh interesting I had mentally filed the <code>raw</code> state as a strictly leaf one</p>



<a name="148120195"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148120195" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148120195">(Nov 21 2018 at 16:13)</a>:</h4>
<p>are you sure you are replying in the right topic...?</p>



<a name="148120208"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148120208" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148120208">(Nov 21 2018 at 16:13)</a>:</h4>
<p>from your link "This could happen if the stack contained, somewhere, a Raw. "</p>



<a name="148120254"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148120254" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148120254">(Nov 21 2018 at 16:14)</a>:</h4>
<p>ah</p>



<a name="148120266"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148120266" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148120266">(Nov 21 2018 at 16:14)</a>:</h4>
<p>well you can reborrow a raw ptr to a mutable ref</p>



<a name="148120267"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148120267" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148120267">(Nov 21 2018 at 16:14)</a>:</h4>
<p>upon reflection it makes sense that raws can be sprinkled through the stack as we upgrade pointers to refs temporarily</p>



<a name="148120269"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148120269" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148120269">(Nov 21 2018 at 16:14)</a>:</h4>
<p>not even so uncommon</p>



<a name="148120325"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148120325" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148120325">(Nov 21 2018 at 16:15)</a>:</h4>
<p>it's just a bit weird to think raw pointer accesses are always valid if there's a raw somewhere in the stack, it will just wildly invalidate a bunch of refs :)</p>



<a name="148120337"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148120337" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148120337">(Nov 21 2018 at 16:15)</a>:</h4>
<p>true</p>



<a name="148120340"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148120340" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148120340">(Nov 21 2018 at 16:15)</a>:</h4>
<p>that's why barriers restrict this :)</p>



<a name="148120401"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148120401" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148120401">(Nov 21 2018 at 16:16)</a>:</h4>
<p>but generally, this kind of stuff happens in an access-based model</p>



<a name="148120413"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148120413" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148120413">(Nov 21 2018 at 16:16)</a>:</h4>
<p>you get exclusivity guarantees for what happened <em>between two accesses</em> with your reference</p>



<a name="148120441"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148120441" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148120441">(Nov 21 2018 at 16:17)</a>:</h4>
<p>if there was a raw ptr access in the mean time, even if it worked, it would have invalidated your ref, so the 2nd access would have been UB, so you can assume that does not happen</p>



<a name="148120535"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148120535" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148120535">(Nov 21 2018 at 16:18)</a>:</h4>
<p>Can you elaborate on how "an &amp;UnsafeCell could actually become invalid, and even deallocated, during the execution of a function"</p>



<a name="148120666"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148120666" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148120666">(Nov 21 2018 at 16:21)</a>:</h4>
<p>well e.g. someone could deallocate that memory</p>



<a name="148120893"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148120893" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148120893">(Nov 21 2018 at 16:25)</a>:</h4>
<p>Can you give some sample code? I can't picture the situation you're describing</p>



<a name="148121185"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148121185" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148121185">(Nov 21 2018 at 16:29)</a>:</h4>
<p>here's a gross example:</p>
<div class="codehilite"><pre><span></span><span class="k">fn</span> <span class="nf">inner</span><span class="p">(</span><span class="n">x</span>: <span class="kp">&amp;</span><span class="nc">UnsafeCell</span><span class="o">&lt;</span><span class="kt">i32</span><span class="o">&gt;</span><span class="p">,</span><span class="w"> </span><span class="n">f</span>: <span class="nc">fn</span><span class="p">())</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="c1">// `f` may mutate x because it is shared +  non-frozen - but is it okay to deallocate?</span>
<span class="w">    </span><span class="n">f</span><span class="p">()</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>

<span class="k">fn</span> <span class="nf">main</span><span class="p">()</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">x</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="nb">Box</span>::<span class="n">into_raw</span><span class="p">(</span><span class="nb">Box</span>::<span class="n">new</span><span class="p">(</span><span class="n">UnsafeCell</span>::<span class="n">new</span><span class="p">(</span><span class="mi">0</span><span class="p">)));</span><span class="w"></span>
<span class="w">    </span><span class="n">inner</span><span class="p">(</span><span class="o">&amp;*</span><span class="n">x</span><span class="p">,</span><span class="w"> </span><span class="o">|</span><span class="n">x</span><span class="o">|</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">        </span><span class="n">drop</span><span class="p">(</span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="nb">Box</span>::<span class="n">from_raw</span><span class="p">(</span><span class="n">x</span><span class="p">)</span><span class="w"> </span><span class="p">});</span><span class="w"></span>
<span class="w">    </span><span class="p">});</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</pre></div>



<a name="148121259"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148121259" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148121259">(Nov 21 2018 at 16:30)</a>:</h4>
<p>a realistic example is actually <code>Arc</code>, where we call <code>fetch_sub</code> to decrement the refcount. immediately after that decrement happened, and before <code>fetch_sub</code> returns, another thread could deallocate the <code>ArcInner</code></p>



<a name="148121386"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148121386" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148121386">(Nov 21 2018 at 16:32)</a>:</h4>
<p>For the UnsafeCell example, I definitely had a mental model that function arguments had a phantom use at the start and end of the function</p>



<a name="148121408"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148121408" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148121408">(Nov 21 2018 at 16:32)</a>:</h4>
<p>(and therefore that code is super busted)</p>



<a name="148121419"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148121419" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148121419">(Nov 21 2018 at 16:32)</a>:</h4>
<p><span class="user-mention" data-user-id="137587">@Gankro</span> oh well then let me make it even more gross</p>



<a name="148121432"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148121432" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148121432">(Nov 21 2018 at 16:32)</a>:</h4>
<div class="codehilite"><pre><span></span><span class="k">fn</span> <span class="nf">inner</span><span class="p">(</span><span class="n">x</span>: <span class="kp">&amp;</span><span class="nc">UnsafeCell</span><span class="o">&lt;</span><span class="kt">i32</span><span class="o">&gt;</span><span class="p">,</span><span class="w"> </span><span class="n">f</span>: <span class="nc">fn</span><span class="p">())</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="c1">// `f` may mutate x because it is shared +  non-frozen - but is it okay to deallocate?</span>
<span class="w">    </span><span class="n">f</span><span class="p">()</span><span class="w"></span>
<span class="w">   </span><span class="c1">// we never get to the end</span>
<span class="w">   </span><span class="k">loop</span><span class="w"> </span><span class="p">{}</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>

<span class="k">fn</span> <span class="nf">main</span><span class="p">()</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">x</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="nb">Box</span>::<span class="n">into_raw</span><span class="p">(</span><span class="nb">Box</span>::<span class="n">new</span><span class="p">(</span><span class="n">UnsafeCell</span>::<span class="n">new</span><span class="p">(</span><span class="mi">0</span><span class="p">)));</span><span class="w"></span>
<span class="w">    </span><span class="n">inner</span><span class="p">(</span><span class="o">&amp;*</span><span class="n">x</span><span class="p">,</span><span class="w"> </span><span class="o">|</span><span class="n">x</span><span class="o">|</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">        </span><span class="n">drop</span><span class="p">(</span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="nb">Box</span>::<span class="n">from_raw</span><span class="p">(</span><span class="n">x</span><span class="p">)</span><span class="w"> </span><span class="p">});</span><span class="w"></span>
<span class="w">    </span><span class="p">});</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</pre></div>



<a name="148121447"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148121447" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148121447">(Nov 21 2018 at 16:33)</a>:</h4>
<p>barriers "kick in" even if the end of the function is never reached</p>



<a name="148121464"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148121464" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148121464">(Nov 21 2018 at 16:33)</a>:</h4>
<p>Right sure</p>



<a name="148121475"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148121475" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148121475">(Nov 21 2018 at 16:33)</a>:</h4>
<p>we have "phantom use at the beginning" in the form of retagging</p>



<a name="148121489"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148121489" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148121489">(Nov 21 2018 at 16:34)</a>:</h4>
<p>right</p>



<a name="148121528"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148121528" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148121528">(Nov 21 2018 at 16:34)</a>:</h4>
<p>but not at the end</p>



<a name="148121534"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148121534" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148121534">(Nov 21 2018 at 16:34)</a>:</h4>
<p>I found barriers more elegant than actually inserting <code>Retag</code> everywhere, I guess</p>



<a name="148121541"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148121541" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148121541">(Nov 21 2018 at 16:34)</a>:</h4>
<p>hm no actually this doesnt work</p>



<a name="148121545"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148121545" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148121545">(Nov 21 2018 at 16:34)</a>:</h4>
<p>So are barriers not reified in mir like retag is?</p>



<a name="148121559"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148121559" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148121559">(Nov 21 2018 at 16:35)</a>:</h4>
<p>consider</p>
<div class="codehilite"><pre><span></span><span class="k">fn</span> <span class="nf">foo</span><span class="p">(</span><span class="n">x</span>: <span class="kp">&amp;</span><span class="nc">mut</span><span class="w"> </span><span class="p">(</span><span class="kt">u8</span><span class="p">,</span><span class="w"> </span><span class="kt">u8</span><span class="p">))</span><span class="w"> </span>-&gt; <span class="kp">&amp;</span><span class="nc">mut</span><span class="w"> </span><span class="kt">u8</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="o">*</span><span class="n">x</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
</pre></div>


<p>surely we dont want a phantom use of <code>x</code> at the end, that would invalidate the return value!</p>



<a name="148121579"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148121579" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148121579">(Nov 21 2018 at 16:35)</a>:</h4>
<blockquote>
<p>So are barriers not reified in mir like retag is?</p>
</blockquote>
<p>retag has a <code>bool</code> parameter saying whether a barrier is pushed</p>



<a name="148121583"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148121583" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148121583">(Nov 21 2018 at 16:35)</a>:</h4>
<p>But barriers <em>do</em> handle <code>foo</code> properly?</p>



<a name="148121588"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148121588" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148121588">(Nov 21 2018 at 16:35)</a>:</h4>
<p>then they are no the stack and affect accesses (but currently not derefs!)</p>



<a name="148121632"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148121632" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148121632">(Nov 21 2018 at 16:36)</a>:</h4>
<p>so yes they are kind-of reified</p>



<a name="148121634"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148121634" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148121634">(Nov 21 2018 at 16:36)</a>:</h4>
<p>but their effect is different from "retag in a few places"</p>



<a name="148121638"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148121638" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148121638">(Nov 21 2018 at 16:36)</a>:</h4>
<blockquote>
<p>But barriers <em>do</em> handle <code>foo</code> properly?</p>
</blockquote>
<p>yes</p>



<a name="148121653"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148121653" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148121653">(Nov 21 2018 at 16:36)</a>:</h4>
<p>(will be back in a couple minutes, need to catch a bus)</p>



<a name="148122213"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148122213" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148122213">(Nov 21 2018 at 16:44)</a>:</h4>
<p>Ok so if this is just asking "is it fine to set barriers on items that aren't the top of the stack", it seems perfectly fine to me?</p>



<a name="148122258"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148122258" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148122258">(Nov 21 2018 at 16:45)</a>:</h4>
<p>that's one of the questions, yes -- going a bit (more) away from a strict stack discipline</p>



<a name="148122271"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148122271" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148122271">(Nov 21 2018 at 16:45)</a>:</h4>
<p>and other question is: what do we do about <code>Arc::drop</code>?</p>



<a name="148122316"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148122316" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148122316">(Nov 21 2018 at 16:46)</a>:</h4>
<p>Although I'm not clear how/why the &amp;UnsafeCell could both not be the top of the stack at the time of a barrier <em>and</em> stuff above it would be reasonable to pop?</p>



<a name="148122327"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148122327" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148122327">(Nov 21 2018 at 16:46)</a>:</h4>
<p>if we indeed want <code>&amp;UnsafeCell</code> to come with a barrier, to ensure that there is no deallocation, we must do something there</p>



<a name="148122336"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148122336" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148122336">(Nov 21 2018 at 16:46)</a>:</h4>
<p>like, have a <code>fetch_sub</code> that takes a raw ptr</p>



<a name="148122392"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148122392" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148122392">(Nov 21 2018 at 16:47)</a>:</h4>
<blockquote>
<p>Although I'm not clear how/why the &amp;UnsafeCell could both not be the top of the stack at the time of a barrier <em>and</em> stuff above it would be reasonable to pop?</p>
</blockquote>
<p>"reasonable to pop"? my favourite <code>RefCell</code> example shows we must not pop stuff on top of a <code>&amp;UnsafeCell</code> barrier:</p>
<div class="codehilite"><pre><span></span><span class="k">fn</span> <span class="nf">aliasing_mut_and_shr</span><span class="p">()</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="k">fn</span> <span class="nf">inner</span><span class="p">(</span><span class="n">rc</span>: <span class="kp">&amp;</span><span class="nc">RefCell</span><span class="o">&lt;</span><span class="kt">i32</span><span class="o">&gt;</span><span class="p">,</span><span class="w"> </span><span class="n">aliasing</span>: <span class="kp">&amp;</span><span class="nc">mut</span><span class="w"> </span><span class="kt">i32</span><span class="p">)</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">        </span><span class="o">*</span><span class="n">aliasing</span><span class="w"> </span><span class="o">+=</span><span class="w"> </span><span class="mi">4</span><span class="p">;</span><span class="w"></span>
<span class="w">        </span><span class="kd">let</span><span class="w"> </span><span class="n">_escape_to_raw</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">rc</span><span class="w"> </span><span class="k">as</span><span class="w"> </span><span class="o">*</span><span class="k">const</span><span class="w"> </span><span class="n">_</span><span class="p">;</span><span class="w"></span>
<span class="w">        </span><span class="o">*</span><span class="n">aliasing</span><span class="w"> </span><span class="o">+=</span><span class="w"> </span><span class="mi">4</span><span class="p">;</span><span class="w"></span>
<span class="w">        </span><span class="kd">let</span><span class="w"> </span><span class="n">_shr</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;*</span><span class="n">rc</span><span class="p">;</span><span class="w"></span>
<span class="w">        </span><span class="o">*</span><span class="n">aliasing</span><span class="w"> </span><span class="o">+=</span><span class="w"> </span><span class="mi">4</span><span class="p">;</span><span class="w"></span>
<span class="w">    </span><span class="p">}</span><span class="w"></span>

<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">rc</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">RefCell</span>::<span class="n">new</span><span class="p">(</span><span class="mi">23</span><span class="p">);</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">bmut</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">rc</span><span class="p">.</span><span class="n">borrow_mut</span><span class="p">();</span><span class="w"></span>
<span class="w">    </span><span class="n">inner</span><span class="p">(</span><span class="o">&amp;</span><span class="n">rc</span><span class="p">,</span><span class="w"> </span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="o">*</span><span class="n">bmut</span><span class="p">);</span><span class="w"></span>
<span class="w">    </span><span class="n">drop</span><span class="p">(</span><span class="n">bmut</span><span class="p">);</span><span class="w"></span>
<span class="w">    </span><span class="n">assert_eq</span><span class="o">!</span><span class="p">(</span><span class="o">*</span><span class="n">rc</span><span class="p">.</span><span class="n">borrow</span><span class="p">(),</span><span class="w"> </span><span class="mi">23</span><span class="o">+</span><span class="mi">12</span><span class="p">);</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</pre></div>



<a name="148122666"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148122666" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148122666">(Nov 21 2018 at 16:51)</a>:</h4>
<p>It seems like that doesn't cover what I'm saying, but not sure</p>



<a name="148122672"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148122672" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148122672">(Nov 21 2018 at 16:51)</a>:</h4>
<p>need to sketch it</p>



<a name="148123094"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148123094" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148123094">(Nov 21 2018 at 16:57)</a>:</h4>
<p>ok let's put it this way: when would it be valid for calling a function to result in a stack reduction?</p>



<a name="148123198"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148123198" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148123198">(Nov 21 2018 at 16:58)</a>:</h4>
<p>naively it would seem that functions have to preserver the caller's stack, since they're opaque..?</p>



<a name="148123254"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148123254" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148123254">(Nov 21 2018 at 16:58)</a>:</h4>
<p>maybe i'm thinking too lifetimey?</p>



<a name="148123570"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148123570" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148123570">(Nov 21 2018 at 17:02)</a>:</h4>
<p>well that's what barriers ensure</p>



<a name="148123580"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148123580" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148123580">(Nov 21 2018 at 17:02)</a>:</h4>
<p>that during a function call, we only pop stuff that was pushed during the call</p>



<a name="148123622"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148123622" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148123622">(Nov 21 2018 at 17:03)</a>:</h4>
<p>it's basically an operational reification of the principle that the lifetimes of references passed to a function outlive that function</p>



<a name="148123690"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148123690" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148123690">(Nov 21 2018 at 17:04)</a>:</h4>
<p>but as the <code>Arc</code> example shows, there are use-cases for <em>other functions in other threads</em> to do stuff that makes my reference invalid</p>



<a name="148123745"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148123745" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148123745">(Nov 21 2018 at 17:05)</a>:</h4>
<p>Is Arc potentially out of scope since you're not "handling" concurrency?</p>



<a name="148123766"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148123766" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148123766">(Nov 21 2018 at 17:05)</a>:</h4>
<p>or alternatively, are atomic ops just special?</p>



<a name="148123774"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148123774" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148123774">(Nov 21 2018 at 17:05)</a>:</h4>
<p>I wouldn't say so</p>



<a name="148123785"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148123785" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148123785">(Nov 21 2018 at 17:05)</a>:</h4>
<p>I have not thought much about concurrency, but all atomic ops happen in non-frozen data</p>



<a name="148123834"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148123834" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148123834">(Nov 21 2018 at 17:06)</a>:</h4>
<p>so they should all be essentially raw accesses with a <code>Shr(None)</code> tag</p>



<a name="148123849"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148123849" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148123849">(Nov 21 2018 at 17:06)</a>:</h4>
<p>which, I think, should work just fine -- except for this detail about deallocation</p>



<a name="148123880"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148123880" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148123880">(Nov 21 2018 at 17:07)</a>:</h4>
<p>and no matter what my model says, it is quite clear that <code>Arc</code> <em>is</em> in conflict with <code>dereferencable</code> as we send it to LLVM</p>



<a name="148123899"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148123899" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148123899">(Nov 21 2018 at 17:07)</a>:</h4>
<p>Stacked Borrows can just tell us whether the fault is in Arc, or in rustc</p>



<a name="148124039"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148124039" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148124039">(Nov 21 2018 at 17:09)</a>:</h4>
<p>Is this only possible because ArcInner has an UnsafeCell?</p>



<a name="148124152"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148124152" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148124152">(Nov 21 2018 at 17:10)</a>:</h4>
<p>yes</p>



<a name="148124163"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148124163" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148124163">(Nov 21 2018 at 17:10)</a>:</h4>
<p>races are generally only possible on <code>UnsafeCell</code></p>



<a name="148124174"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148124174" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148124174">(Nov 21 2018 at 17:10)</a>:</h4>
<p>as they require shared accesses where at least one is a write</p>



<a name="148124184"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148124184" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148124184">(Nov 21 2018 at 17:10)</a>:</h4>
<p>ok now I see why you brought up this freeing closure example</p>



<a name="148124295"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148124295" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148124295">(Nov 21 2018 at 17:12)</a>:</h4>
<p>:)</p>



<a name="148125627"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148125627" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148125627">(Nov 21 2018 at 17:37)</a>:</h4>
<p>I am increasingly convincing myself that &amp;UnsafeCell should not be considered dereferenceable, as they are all candidates for atomic accesses, which seems fundamentally racey?</p>



<a name="148125900"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148125900" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148125900">(Nov 21 2018 at 17:41)</a>:</h4>
<p>I've been back-and-forth between both possibilities</p>



<a name="148125912"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148125912" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148125912">(Nov 21 2018 at 17:41)</a>:</h4>
<p>but it definitely seems footgun-y to make it <code>dereferencable</code></p>



<a name="148126091"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148126091" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148126091">(Nov 21 2018 at 17:44)</a>:</h4>
<p>Also I will blindly assert optimizing UnsafeCell memory accesses is low impact?</p>



<a name="148126362"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148126362" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148126362">(Nov 21 2018 at 17:48)</a>:</h4>
<p>I do not like that I am leaning towards the freeing-closure being valid</p>



<a name="148127321"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148127321" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148127321">(Nov 21 2018 at 18:04)</a>:</h4>
<blockquote>
<p>Also I will blindly assert optimizing UnsafeCell memory accesses is low impact?</p>
</blockquote>
<p>I guess we should measure that?</p>



<a name="148130607"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148130607" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148130607">(Nov 21 2018 at 18:56)</a>:</h4>
<p>I mean, intuitively either every access is carefully managed and so there's not much to do (Arc) or you escape to internal references ASAP (RefCell)</p>



<a name="148131045"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148131045" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148131045">(Nov 21 2018 at 19:05)</a>:</h4>
<p>"internal references"?</p>



<a name="148131288"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148131288" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148131288">(Nov 21 2018 at 19:10)</a>:</h4>
<p>Like with RefCell/Mutex you make a guard and then promote that to a reference inside (and thus unaffected by) the UnsafeCell</p>



<a name="148131400"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148131400" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148131400">(Nov 21 2018 at 19:13)</a>:</h4>
<p>ah I see. yes.</p>



<a name="148140254"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148140254" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148140254">(Nov 21 2018 at 22:08)</a>:</h4>
<blockquote>
<p>For the UnsafeCell example, I definitely had a mental model that function arguments had a phantom use at the start and end of the function</p>
</blockquote>
<p>btw, this immediately implies that <code>BTreeMap</code> as of now is incorrect, because that phantom use is out-of-bounds if the reference points to an allocation that is "too short" compared to its type ;)</p>



<a name="148167928"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148167928" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148167928">(Nov 22 2018 at 10:49)</a>:</h4>
<p><span class="user-mention" data-user-id="137587">@Gankro</span> </p>
<blockquote>
<p>I mean, intuitively either every access is carefully managed and so there's not much to do (Arc) or you escape to internal references ASAP (RefCell)</p>
</blockquote>
<p>This sorta makes sense for Arc and RefCell, but UnsafeCell also powers Cell, which is supposed to be a cheap way to get shared mutable memory -- much like any <code>T &amp;</code> in C++, for example. I can easily see <code>dereferenceable</code> mattering for that kind of usage. I am actually coming around to UnsafeCell allowing deallocation under one's feet (Clang's usage of <code>dereferenceable</code> is unsound for the same reasons) but it might very well result in a measurable loss of optimization power.</p>



<a name="148171217"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148171217" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148171217">(Nov 22 2018 at 12:01)</a>:</h4>
<p>Ideally <code>Cell</code> could opt back into that, but that seems hard to do practically</p>



<a name="148171231"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148171231" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148171231">(Nov 22 2018 at 12:01)</a>:</h4>
<p>FWIW, all the complications around barriers for <code>UnsafeCell</code> do not apply to <code>Cell</code> because one cannot get a reference into a <code>Cell</code></p>



<a name="148184613"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148184613" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148184613">(Nov 22 2018 at 16:25)</a>:</h4>
<p>wait, question - why can't we mark it as dereferenceable, given that C++ has the same issue?</p>



<a name="148184626"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148184626" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148184626">(Nov 22 2018 at 16:25)</a>:</h4>
<p>(which would imply it's not UB to deallocate from under the feet of a reference)</p>



<a name="148184630"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148184630" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148184630">(Nov 22 2018 at 16:25)</a>:</h4>
<p>unless this is a known bug in LLVM</p>



<a name="148184869"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148184869" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148184869">(Nov 22 2018 at 16:30)</a>:</h4>
<blockquote>
<p>unless this is a known bug in LLVM</p>
</blockquote>
<p>it is</p>



<a name="148184873"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148184873" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148184873">(Nov 22 2018 at 16:30)</a>:</h4>
<p>see <a href="https://lists.llvm.org/pipermail/llvm-dev/2018-July/124555.html" target="_blank" title="https://lists.llvm.org/pipermail/llvm-dev/2018-July/124555.html">https://lists.llvm.org/pipermail/llvm-dev/2018-July/124555.html</a></p>



<a name="148191815"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148191815" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148191815">(Nov 22 2018 at 19:28)</a>:</h4>
<p>mmh</p>



<a name="148191819"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148191819" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148191819">(Nov 22 2018 at 19:28)</a>:</h4>
<p>does this cause an issue in practice?</p>



<a name="148191828"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148191828" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148191828">(Nov 22 2018 at 19:29)</a>:</h4>
<p>I'd be tempted to use it as long as it doesn't, since if it does, then C++ also becomes wrong</p>



<a name="148191830"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148191830" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148191830">(Nov 22 2018 at 19:29)</a>:</h4>
<p>and we can yell at LLVM</p>



<a name="148192030"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148192030" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148192030">(Nov 22 2018 at 19:34)</a>:</h4>
<p>well I'd say we should first decide what guarantee we want -- we could also declare <code>Arc::drop</code> to be wrong</p>



<a name="148192042"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148192042" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148192042">(Nov 22 2018 at 19:35)</a>:</h4>
<p>if we decide that <code>Arc::drop</code> is right and rustc is wrong, we should at least open an I-unsound issue to track this</p>



<a name="148192111"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%3A%20barriers%20for%20non-frrozen%20shared%20refs%3F/near/148192111" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.3A.20barriers.20for.20non-frrozen.20shared.20refs.3F.html#148192111">(Nov 22 2018 at 19:37)</a>:</h4>
<p>(a bit like <a href="https://github.com/rust-lang/rust/issues/28728" target="_blank" title="https://github.com/rust-lang/rust/issues/28728">https://github.com/rust-lang/rust/issues/28728</a>: fix required but blocked on someone getting LLVM in shape)</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>